The main power proposed in the bill is the requirement for blanket retention of 12 months’ of records of all websites visited by British citizens.
Photograph: Robert Matton AB/Alamy

Mass surveillance

The home secretary used the bill’s publication to avow – officially acknowledge for the first time – that successive British governments repeatedly signed off “secret directions” to phone and web companies to hand over large volumes of personal communications data of British citizens to MI5 and the security services “in the interests of national security”.

The surveillance bill is as big a threat to state security as to personal liberty | Simon Jenkins

Read more

Her admission means that secret mass snooping has been taking place since at least 2000.

The bulk data obtained under these Snowden-style mass surveillance programmes is used to “identify subjects of interest” and the power to issue these directions under the 1984 Telecommunications Act is maintained in the new bill. This is just one form of “bulk collection” of large volumes of personal data explicitly permitted under the bill.

Others include powers such as hacking into computers and smart phones worldwide for national security and economic well-being purposes.

Web logs/internet use records

The main power proposed is the requirement for blanket retention of 12 months’ of records of all websites visited by British citizens. This stops short of full web histories, which would include page views and links clicked. But privacy campaigners say internet connection records – as they are officially known – are highly intrusive.

The home secretary insists they will not be used to show which medical sites or mental health sites suspects have visited but to identify communication services they have used, such as Whats-App, and any illegal sites visited, such as images of child abuse and also to link their device to particular sites.

These records are seen as so intrusive that their disclosure is banned in Canada, US, Australia and Europe, including Britain, where access was banned under the 2015 Counter-Terrorism and Security Act. Records will be subject to the same authorisation procedure as the other 500,000 communication data requests made yearly. A European court of justice case placed a question mark over whether such an authorisation process meets human rights standards. The cost of storing the data is estimated to about £175m over the next 10 years.

Communications data

Security services and police access to other forms of communication data already kept for 12 months by web and phone firms is unaltered. Police and 34 other public bodies can access this data for investigations ranging from counter-terrorism to missing teenagers.

A new criminal offence with a two-year prison term will enforce a ban on internet firms, such as Google or Facebook, telling customers they are the subject of a request for their personal data (unless expressly permitted to do so). An offence of “wilfully or recklessly obtaining communications data” will ban misuse of data by the firms or public bodies. The bill will require internet firms to have “permanent capabilities” to collect and store communications data, and intercept material.

Overseas companies

The bill places the same legal obligations on all companies providing services in Britain but the Home Office says it will not be able to enforce obligations in court on American internet firms. Legal enforcement will be limited to requests for targeted communications data and targeted and bulk interception requests.

The government is to try to negotiate a new treaty with the US for voluntary cooperation on data sharing.

State computer hacking

The bill gives powers for security services to hack in to phones, computers and networks worldwide in interests of national security. It is known as equipment interference. The legislation also makes clear the police have access to these powers. But it also for the first time places a legal obligation on firms to assist with hacking warrants, including breaking into their own encrypted services. It can be used on an industrial scale and smart phones can be used as mobile cameras and remote listening devices without the owners’ knowledge.

Judicial authorisation

A “double-lock” authorisation process is proposed for ministerial warrants for interception of communications message contents] for computer hacking and bulk collection of communications data. Authorisation of a warrant by a secretary of state will have to be approved by one of seven judicial commissioners. Warrants rejected by commissioners can be resubmitted and are likely to be subject to negotiation not outright refusal.

An “urgency” provision (needed within five days) will allow warrants without pre-judicial approval. Officials say this would only happen in a handful of cases. The Home Office regards “operational agility” and problems of setting a precedent for judicial involvement in executive decisions as main considerations in the new regime.

MPs, journalists and others

Surveillance bill triggers alarm over sweeping powers for spies

Read more

The prime minister will be consulted before an interception warrant is authorised for an MP. Previously that power resided with the home secretary. For journalists, lawyers and doctors, who have legally privileged information, a code of practice ensuring safeguards are in place before a warrant is authorised, will be written into statute. That includes the need for magistrates’ approval relating to journalistic sources.

Oversight and redress

The existing system of three separate surveillance and intercept commissioners is to be replaced by one overarching investigatory powers commissioner. This will be a senior judge nominated by the lord chief justice and appointed by the prime minister. That person will have the right to inform only those individuals subjected to serious surveillance errors of the fact. A right of appeal is also to be introduced from the investigatory powers tribunal – the only court in Britain that can try intelligence cases.